From 29f3e2789d82c004aba41813cf2b4c588cfed889 Mon Sep 17 00:00:00 2001
From: Jens L <jens@goauthentik.io>
Date: Tue, 2 Jul 2024 07:29:32 +0900
Subject: [PATCH] web: set noopener and noreferrer on all external links
 (#10304)

Signed-off-by: Jens Langhammer <jens@goauthentik.io>
---
 authentik/core/templates/login/base_full.html            | 2 +-
 authentik/stages/email/templates/email/base.html         | 2 +-
 internal/outpost/proxyv2/templates/error.html            | 2 +-
 web/src/admin/admin-overview/AdminOverviewPage.ts        | 9 ++++++++-
 web/src/admin/admin-overview/cards/VersionStatusCard.ts  | 2 +-
 web/src/admin/blueprints/BlueprintForm.ts                | 1 +
 web/src/admin/outposts/OutpostDeploymentModal.ts         | 1 +
 web/src/admin/outposts/OutpostForm.ts                    | 9 ++++++---
 .../admin/policies/expression/ExpressionPolicyForm.ts    | 1 +
 .../PropertyMappingGoogleWorkspaceForm.ts                | 1 +
 .../admin/property-mappings/PropertyMappingLDAPForm.ts   | 1 +
 .../PropertyMappingMicrosoftEntraForm.ts                 | 1 +
 .../property-mappings/PropertyMappingNotification.ts     | 1 +
 .../admin/property-mappings/PropertyMappingRACForm.ts    | 1 +
 .../admin/property-mappings/PropertyMappingSAMLForm.ts   | 1 +
 .../admin/property-mappings/PropertyMappingSCIMForm.ts   | 1 +
 .../admin/property-mappings/PropertyMappingScopeForm.ts  | 1 +
 web/src/elements/Markdown.ts                             | 2 +-
 web/src/flow/FlowExecutor.ts                             | 2 ++
 .../LibraryPage/ak-library-application-empty-list.ts     | 2 +-
 20 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/authentik/core/templates/login/base_full.html b/authentik/core/templates/login/base_full.html
index c88692a63230..a9d199ba62c7 100644
--- a/authentik/core/templates/login/base_full.html
+++ b/authentik/core/templates/login/base_full.html
@@ -71,7 +71,7 @@ <h1 class="pf-c-title pf-m-3xl">
                 </li>
                 {% endfor %}
                 <li>
-                    <a href="https://goauthentik.io?utm_source=authentik">
+                    <a rel="noopener noreferrer" target="_blank" href="https://goauthentik.io?utm_source=authentik">
                         {% trans 'Powered by authentik' %}
                     </a>
                 </li>
diff --git a/authentik/stages/email/templates/email/base.html b/authentik/stages/email/templates/email/base.html
index 1b3dfc84b5c2..08a60107a035 100644
--- a/authentik/stages/email/templates/email/base.html
+++ b/authentik/stages/email/templates/email/base.html
@@ -120,7 +120,7 @@
             </tr>
             <tr>
               <td align="center">
-                Powered by <a href="https://goauthentik.io?utm_source=authentik&utm_medium=email">authentik</a>.
+                Powered by <a rel="noopener noreferrer" target="_blank" href="https://goauthentik.io?utm_source=authentik&utm_medium=email">authentik</a>.
               </td>
             </tr>
           </table>
diff --git a/internal/outpost/proxyv2/templates/error.html b/internal/outpost/proxyv2/templates/error.html
index 94df097145ff..95a554d3db55 100644
--- a/internal/outpost/proxyv2/templates/error.html
+++ b/internal/outpost/proxyv2/templates/error.html
@@ -48,7 +48,7 @@ <h1 class="pf-c-title pf-m-3xl">
                 <footer class="pf-c-login__footer">
                     <ul class="pf-c-list pf-m-inline">
                         <li>
-                            <a href="https://goauthentik.io?utm_source=authentik_outpost&utm_campaign=proxy_error">
+                            <a rel="noopener noreferrer" target="_blank" href="https://goauthentik.io?utm_source=authentik_outpost&utm_campaign=proxy_error">
                                 Powered by authentik
                             </a>
                         </li>
diff --git a/web/src/admin/admin-overview/AdminOverviewPage.ts b/web/src/admin/admin-overview/AdminOverviewPage.ts
index f361d11ac10b..238faadf5c17 100644
--- a/web/src/admin/admin-overview/AdminOverviewPage.ts
+++ b/web/src/admin/admin-overview/AdminOverviewPage.ts
@@ -208,7 +208,14 @@ export class AdminOverviewPage extends AdminOverviewBase {
 
             return html`<li>
                 ${ex(
-                    () => html`<a href="${url}" class="pf-u-mb-xl" target="_blank">${content}</a>`,
+                    () =>
+                        html`<a
+                            href="${url}"
+                            class="pf-u-mb-xl"
+                            rel="noopener noreferrer"
+                            target="_blank"
+                            >${content}</a
+                        >`,
                     () => html`<a href="${url}" class="pf-u-mb-xl" )>${content}</a>`,
                 )}
             </li>`;
diff --git a/web/src/admin/admin-overview/cards/VersionStatusCard.ts b/web/src/admin/admin-overview/cards/VersionStatusCard.ts
index a8c94cc3776f..7b91b1a5dcbf 100644
--- a/web/src/admin/admin-overview/cards/VersionStatusCard.ts
+++ b/web/src/admin/admin-overview/cards/VersionStatusCard.ts
@@ -56,6 +56,6 @@ export class VersionStatusCard extends AdminStatusCard<Version> {
             text = this.value.buildHash?.substring(0, 7);
             link = `https://github.com/goauthentik/authentik/commit/${this.value.buildHash}`;
         }
-        return html`<a href=${link} target="_blank">${text}</a>`;
+        return html`<a rel="noopener noreferrer" href=${link} target="_blank">${text}</a>`;
     }
 }
diff --git a/web/src/admin/blueprints/BlueprintForm.ts b/web/src/admin/blueprints/BlueprintForm.ts
index 2df50180b3ea..9d5886ff4873 100644
--- a/web/src/admin/blueprints/BlueprintForm.ts
+++ b/web/src/admin/blueprints/BlueprintForm.ts
@@ -157,6 +157,7 @@ export class BlueprintForm extends ModelForm<BlueprintInstance, string> {
                                   ${msg("See more about OCI support here:")}&nbsp;
                                   <a
                                       target="_blank"
+                                      rel="noopener noreferrer"
                                       href="${docLink(
                                           "/developer-docs/blueprints/?utm_source=authentik#storage---oci",
                                       )}"
diff --git a/web/src/admin/outposts/OutpostDeploymentModal.ts b/web/src/admin/outposts/OutpostDeploymentModal.ts
index effa687cf64d..d97a2bc7397e 100644
--- a/web/src/admin/outposts/OutpostDeploymentModal.ts
+++ b/web/src/admin/outposts/OutpostDeploymentModal.ts
@@ -23,6 +23,7 @@ export class OutpostDeploymentModal extends ModalButton {
                     <a
                         target="_blank"
                         href="${docLink("/docs/outposts?utm_source=authentik#deploy")}"
+                        rel="noopener noreferrer"
                         >${msg("View deployment documentation")}</a
                     >
                 </p>
diff --git a/web/src/admin/outposts/OutpostForm.ts b/web/src/admin/outposts/OutpostForm.ts
index d5791cadedfe..63c5d846fbf4 100644
--- a/web/src/admin/outposts/OutpostForm.ts
+++ b/web/src/admin/outposts/OutpostForm.ts
@@ -210,9 +210,11 @@ export class OutpostForm extends ModelForm<Outpost, string> {
                     )}
                 </p>
                 <p class="pf-c-form__helper-text">
-                    See
-                    <a target="_blank" href="${docLink("/docs/outposts?utm_source=authentik")}"
-                        >documentation</a
+                    <a
+                        target="_blank"
+                        rel="noopener noreferrer"
+                        href="${docLink("/docs/outposts?utm_source=authentik")}"
+                        >${msg("See documentation")}</a
                     >.
                 </p>
             </ak-form-element-horizontal>
@@ -245,6 +247,7 @@ export class OutpostForm extends ModelForm<Outpost, string> {
                             ${msg("See more here:")}&nbsp;
                             <a
                                 target="_blank"
+                                rel="noopener noreferrer"
                                 href="${docLink(
                                     "/docs/outposts?utm_source=authentik#configuration",
                                 )}"
diff --git a/web/src/admin/policies/expression/ExpressionPolicyForm.ts b/web/src/admin/policies/expression/ExpressionPolicyForm.ts
index 01c603914785..c99a158b97b9 100644
--- a/web/src/admin/policies/expression/ExpressionPolicyForm.ts
+++ b/web/src/admin/policies/expression/ExpressionPolicyForm.ts
@@ -85,6 +85,7 @@ export class ExpressionPolicyForm extends BasePolicyForm<ExpressionPolicy> {
                         <p class="pf-c-form__helper-text">
                             ${msg("Expression using Python.")}
                             <a
+                                rel="noopener noreferrer"
                                 target="_blank"
                                 href="${docLink("/docs/policies/expression?utm_source=authentik")}"
                             >
diff --git a/web/src/admin/property-mappings/PropertyMappingGoogleWorkspaceForm.ts b/web/src/admin/property-mappings/PropertyMappingGoogleWorkspaceForm.ts
index 3677fc3a991c..5cb11017e302 100644
--- a/web/src/admin/property-mappings/PropertyMappingGoogleWorkspaceForm.ts
+++ b/web/src/admin/property-mappings/PropertyMappingGoogleWorkspaceForm.ts
@@ -62,6 +62,7 @@ export class PropertyMappingGoogleWorkspaceForm extends BasePropertyMappingForm<
                     ${msg("Expression using Python.")}
                     <a
                         target="_blank"
+                        rel="noopener noreferrer"
                         href="${docLink("/docs/property-mappings/expression?utm_source=authentik")}"
                     >
                         ${msg("See documentation for a list of all variables.")}
diff --git a/web/src/admin/property-mappings/PropertyMappingLDAPForm.ts b/web/src/admin/property-mappings/PropertyMappingLDAPForm.ts
index 4647a3e70a4b..3aa99f4570d8 100644
--- a/web/src/admin/property-mappings/PropertyMappingLDAPForm.ts
+++ b/web/src/admin/property-mappings/PropertyMappingLDAPForm.ts
@@ -71,6 +71,7 @@ export class PropertyMappingLDAPForm extends BasePropertyMappingForm<LDAPPropert
                     ${msg("Expression using Python.")}
                     <a
                         target="_blank"
+                        rel="noopener noreferrer"
                         href="${docLink("/docs/property-mappings/expression?utm_source=authentik")}"
                     >
                         ${msg("See documentation for a list of all variables.")}
diff --git a/web/src/admin/property-mappings/PropertyMappingMicrosoftEntraForm.ts b/web/src/admin/property-mappings/PropertyMappingMicrosoftEntraForm.ts
index c517616f8bdf..ffa54cb64ce9 100644
--- a/web/src/admin/property-mappings/PropertyMappingMicrosoftEntraForm.ts
+++ b/web/src/admin/property-mappings/PropertyMappingMicrosoftEntraForm.ts
@@ -62,6 +62,7 @@ export class PropertyMappingMicrosoftEntraForm extends BasePropertyMappingForm<M
                     ${msg("Expression using Python.")}
                     <a
                         target="_blank"
+                        rel="noopener noreferrer"
                         href="${docLink("/docs/property-mappings/expression?utm_source=authentik")}"
                     >
                         ${msg("See documentation for a list of all variables.")}
diff --git a/web/src/admin/property-mappings/PropertyMappingNotification.ts b/web/src/admin/property-mappings/PropertyMappingNotification.ts
index fe88b1a8c1a7..03ebc8911865 100644
--- a/web/src/admin/property-mappings/PropertyMappingNotification.ts
+++ b/web/src/admin/property-mappings/PropertyMappingNotification.ts
@@ -62,6 +62,7 @@ export class PropertyMappingNotification extends ModelForm<NotificationWebhookMa
                     ${msg("Expression using Python.")}
                     <a
                         target="_blank"
+                        rel="noopener noreferrer"
                         href="${docLink("/docs/property-mappings/expression?utm_source=authentik")}"
                     >
                         ${msg("See documentation for a list of all variables.")}
diff --git a/web/src/admin/property-mappings/PropertyMappingRACForm.ts b/web/src/admin/property-mappings/PropertyMappingRACForm.ts
index 23609c7bb7b7..a9deeef3f183 100644
--- a/web/src/admin/property-mappings/PropertyMappingRACForm.ts
+++ b/web/src/admin/property-mappings/PropertyMappingRACForm.ts
@@ -160,6 +160,7 @@ export class PropertyMappingLDAPForm extends ModelForm<RACPropertyMapping, strin
                             ${msg("Expression using Python.")}
                             <a
                                 target="_blank"
+                                rel="noopener noreferrer"
                                 href="${docLink(
                                     "/docs/property-mappings/expression?utm_source=authentik",
                                 )}"
diff --git a/web/src/admin/property-mappings/PropertyMappingSAMLForm.ts b/web/src/admin/property-mappings/PropertyMappingSAMLForm.ts
index 9371bb5caaa2..15a907baf0f1 100644
--- a/web/src/admin/property-mappings/PropertyMappingSAMLForm.ts
+++ b/web/src/admin/property-mappings/PropertyMappingSAMLForm.ts
@@ -83,6 +83,7 @@ export class PropertyMappingSAMLForm extends BasePropertyMappingForm<SAMLPropert
                     ${msg("Expression using Python.")}
                     <a
                         target="_blank"
+                        rel="noopener noreferrer"
                         href="${docLink("/docs/property-mappings/expression?utm_source=authentik")}"
                     >
                         ${msg("See documentation for a list of all variables.")}
diff --git a/web/src/admin/property-mappings/PropertyMappingSCIMForm.ts b/web/src/admin/property-mappings/PropertyMappingSCIMForm.ts
index 51bcfc65d33b..4aa118a7e738 100644
--- a/web/src/admin/property-mappings/PropertyMappingSCIMForm.ts
+++ b/web/src/admin/property-mappings/PropertyMappingSCIMForm.ts
@@ -56,6 +56,7 @@ export class PropertyMappingSCIMForm extends BasePropertyMappingForm<SCIMMapping
                     ${msg("Expression using Python.")}
                     <a
                         target="_blank"
+                        rel="noopener noreferrer"
                         href="${docLink("/docs/property-mappings/expression?utm_source=authentik")}"
                     >
                         ${msg("See documentation for a list of all variables.")}
diff --git a/web/src/admin/property-mappings/PropertyMappingScopeForm.ts b/web/src/admin/property-mappings/PropertyMappingScopeForm.ts
index 6403e0c6ec85..f60b83696321 100644
--- a/web/src/admin/property-mappings/PropertyMappingScopeForm.ts
+++ b/web/src/admin/property-mappings/PropertyMappingScopeForm.ts
@@ -83,6 +83,7 @@ export class PropertyMappingScopeForm extends BasePropertyMappingForm<ScopeMappi
                     ${msg("Expression using Python.")}
                     <a
                         target="_blank"
+                        rel="noopener noreferrer"
                         href="${docLink("/docs/property-mappings/expression?utm_source=authentik")}"
                     >
                         ${msg("See documentation for a list of all variables.")}
diff --git a/web/src/elements/Markdown.ts b/web/src/elements/Markdown.ts
index 896acfa861d6..dae42e1d1876 100644
--- a/web/src/elements/Markdown.ts
+++ b/web/src/elements/Markdown.ts
@@ -78,7 +78,7 @@ export class Markdown extends AKElement {
             const pathName = path.replace(".md", "");
             const link = `docs/${baseName}${pathName}`;
             const url = new URL(link, baseUrl).toString();
-            return `href="${url}" _target="blank"`;
+            return `href="${url}" _target="blank" rel="noopener noreferrer"`;
         });
     }
 
diff --git a/web/src/flow/FlowExecutor.ts b/web/src/flow/FlowExecutor.ts
index 761a55cda507..471f0abf666d 100644
--- a/web/src/flow/FlowExecutor.ts
+++ b/web/src/flow/FlowExecutor.ts
@@ -512,6 +512,8 @@ export class FlowExecutor extends Interface implements StageHost {
                                                 <li>
                                                     <a
                                                         href="https://goauthentik.io?utm_source=authentik&amp;utm_medium=flow"
+                                                        target="_blank"
+                                                        rel="noopener noreferrer"
                                                         >${msg("Powered by authentik")}</a
                                                     >
                                                 </li>
diff --git a/web/src/user/LibraryPage/ak-library-application-empty-list.ts b/web/src/user/LibraryPage/ak-library-application-empty-list.ts
index bcd62611aa43..6e67b2efc202 100644
--- a/web/src/user/LibraryPage/ak-library-application-empty-list.ts
+++ b/web/src/user/LibraryPage/ak-library-application-empty-list.ts
@@ -54,7 +54,7 @@ export class LibraryPageApplicationEmptyList extends AKElement {
                 >
             </div>
             <div class="pf-c-empty-state__body">
-                <a href="${docLink("/docs/applications")}" target="_blank"
+                <a rel="noopener noreferrer" href="${docLink("/docs/applications")}" target="_blank"
                     >${msg("Refer to documentation")}</a
                 >
             </div>